CVE-2026-26239: File Station 5

Synopsis

A buffer overflow vulnerability affects QNAP File Station 5 (versions 5.5.0 through 5.5.6.5208). The flaw is reachable over the network and requires a low-privilege user account, meaning any authenticated user can trigger it without additional interaction from another party. Successful exploitation lets an attacker modify memory or crash running processes, enabling data tampering and service disruption. A patched-image rebuild at version 5.5.6.5208 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the File Station 5 service over the network; no local or physical access is needed.

• AuthenticationRequired

  A low-privilege user account is sufficient; no administrative or elevated credentials are required beyond basic login access.

• Victim interactionNot required

  No action from another user or victim is needed to trigger the vulnerability.

• Attack complexityDetail

  The exploit is reliable and condition-free, with no race conditions or specific memory layout dependencies required.

Blast Radius

• Attacker writes arbitrary data to process memory, enabling code or control-flow manipulation within the File Station 5 process.
• Attacker crashes one or more File Station 5 processes, denying file access and management functionality to all users of the affected system.
• Attacker reads or corrupts in-memory file metadata, stored credentials, or session state handled by the running process.
• Combined memory modification and process crash capability gives the attacker persistent disruption and potential for escalated impact on co-located services.